Makes use of the framework's foreground persistence service

Application may abuse the framework's foreground service to continue running in the foreground.

Requests enabling of the accessibility settings.

Tries to add a device administrator.

Acquires the wake lock

Checks if the internet connection is available

Legitimate hosting services abused for malware hosting/C2

Requests disabling of battery optimizations (often used to enable hiding in the background).